REMARKS 



Claims 1-16 were presented for examination and were rejected. Reconsider- 
ation of this application in view of the following remarks, and allowance of all claims 
herein, claims 1-16 as amended, are hereby respectfully requested. 

In the second and third paragraphs of her Office Action, the Examiner rejected 
claims 1-16 under 35 U.S.C. §1 02(e) as being anticipated by Chen . Applicant hereby 
traverses this rejection. 

All of Applicant's independent claims (claims 1, 5-10, 13, 14, and 16), and thus 
all of Applicant's claims, contain two critical limitations that are not suggested by Chen : 

1) the code contains instructions causing a macro to be moved to a global 
environment ; and 

2) the code contains instructions causing a macro to be copied to a local 
document . 

The Examiner cited column 6 lines 31-46 and column 11 lines 30-31 of Chen for 
the first proposition (a macro is moved to a global environment). These passages of 
Chen does not suggest a macro being moved anywhere. The portion of Chen most 
relevant to Applicant's first critical limitation is column 13 line 50 through column 14 line 
24, especially column 14 lines 8-15. 

In construing Chen , one should keep in mind that Chen 's "template file" is 
analogous to Applicant's "global environment 13"; and that Chen 's "application data 
file" is analogous to Applicant's "local document 11". Chen further states that a 



2 



template file can have a .dot extension, and an application data file can have a .doc 
extension, when the application is Microsoft Word. 

The passage at Chen column 13 line 50 through column 14 line 24 states that 
one way to detect the presence of an unknown macro is to detect the combination of a 
"macro enablement instruction" and a "macro reproduction instruction". Chen defines a 
"macro enablement instruction" as one that formats a file to indicate that the file 
includes a macro for execution. Column 13 lines 52-54. This does not suggest the 
"move" nor the "global environment" in Applicant's first critical limitation (instructions 
causing a macro to be moved to a global environment) . Chen states at column 14 lines 
8-13 that the instruction "FileSaveAs a$,1" is one example of a macro enablement 
instruction. Chen defines this instruction to mean " keep an original file and save an , 
additional copy of the file under a different format such as one that indicates that the file 
can include an embedded macro"(emphasis added). Column 14 lines 9-12. The fact 
that this instruction requires both a keep and a save implies that it is a copy instruction, 
not a move instruction as required by the Applicant's first critical limitation. 
Furthermore, there is no suggestion of a global environment in this definition. A global 
environment is also a requirement of Applicant's first critical limitation. 

The second prong of Chen 's test for the presence of a macro is the presence of 
a macro reproduction instruction. Column 13 lines 50-52. As an example of a macro 
reproduction instruction, Chen mentions the instruction "MacroCopy". Column 14 lines 
16-20. Chen defines MacroCopy as "copies a macro, and if the macro is infected, all of 
its harmful instructions, from a source to a destination". Column 14 lines 18-20. This 
definition discloses the "copy" part of Applicant's second critical limitation (instructions 
causing a macro to be copied to a local document), but does not suggest the local 
document requirement in Applicant's second critical limitation. 



The Examiner cited Chen column 9 lines 44-45 and column 10 line 25 for 
Applicants claim 1 recitation of "when the code contains instructions causing a macro 
to be moved to a global environment, flagging said macro." However, the flag cited by 
the Examiner at column 9 lines 44-45 is a flag that Chen uses to distinguish between a 
known virus and an unknown virus, and not the type of flag used by Applicant, which is 
a flag indicating that the first prong of Applicants test for detecting a macro virus has 
been satisfied and therefore it is warranted to test for the second prong. Furthermore, 
the fact that Chen has a flag for distinguishing between known and unknown viruses 
underscores another important difference between Chen and Applicant's invention: 
namely, that in Chen the processing is different for known versus unknown viruses, 
whereas in Applicant's invention, the processing is exactly the same. 

The flag cited by Examiner at column 10 line 25 of Chen is a flag for indicating 
whether the treated macro has integrity or not. This flag is used in Chen 's treatment 
phase. Thus, this flag is not directed to detection of viruses, to which all of Applicant's 
independent claims are exclusively directed. 

The Examiner cited column 8 lines 32-39 for Applicant's claim 1 recitation of 
"analyzing the code to determine whether said code contains instructions causing the 
flagged macro to be copied to a local document." However, the passage cited by the 
Examiner describes the behavior of macro viruses, and not Chen 's invention, and is 
therefore irrelevant. 

The Examiner cited Chen column 10 lines 52-56 and column 15 lines 46-50 for 
Applicant's claim 1 recitation of "when the code contains instructions causing the 
flagged macro to be copied to a local document, declaring that said flagged macro 
contains a macro virus." However, the passage cited by the Examiner at column 10 
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pertains to Chen 's correction of infected macros, not the detection of macro viruses to 
which all of Applicant's independent claims are exclusively directed. The passage cited 
by the Examiner at column 15 does pertain to flagging infected macros in a detection 
phase, but, as discussed above, the detection criteria for deciding whether a macro 
virus is present are different in Chen than in the present invention. 

The above discussion has demonstrated that Applicant's independent claims 
(claims 1, 5-10, 13, 14, and 16) are patentable over the cited Chen reference. 
Applicant's remaining claims (2-4, 11,12, and 15) are dependent upon his independent 
claims, and therefore the patentability of these dependent claims follows from the 
patentability of the independent claims. 

With respect to claim 2, the Examiner cited Chen column 6 lines 31-36 for 
Applicant's recitation that "the macro is contained within a module." However, the 
passage cited by the Examiner refers to Chen 's macro virus detection module 206 (the 
module doing the testing), which has nothing to do with the fact that Applicant's macro 
(the code being tested) is contained within a module. 

With respect to claim 4, the Examiner cited Chen column 7 lines 11-13 and 
column 8 lines 1-4 for the proposition that the code is written in the Visual Basic 
language. However, the only language referred to in the cited passages is WordBasic, 
not Visual Basic. The Examiner makes the statement that the Visual Basic language is 
a trademarked name owned by Microsoft Corporation and is designed for building 
Windows-based applications such as Microsoft Office including word processing and 
the Excel spreadsheet, without providing any documentation supporting these 
assertions. 

5 



With respect to claim 5, the SaveAs command recited in claim 5 is for the special 
case where the code is in Visual Basic. Specification page 12 lines 21-26. Note that 
when Chen discusses the FileSaveAs (not SaveAs) command in column 14 lines 8-15, 
Chen's application software is WordBasic, not Visual Basic. Column 13 line 64; column 
5 lines 37-38. 

Further with respect to claim 5, the Examiner cited Chen column 10 lines 22-23, 
column 11 lines 30-31, column 6 lines 2-13, and column 8 lines 38-39 for Applicant's 
recitation of "analyzing the code to determine whether said code contains instructions 
causing a macro to be moved to a global environment." The cited passages do not 
support this recitation. Out of the four cited passages, the first and second ones pertain 
to the treatment of infected macros, not to the detection of macro viruses, which is the 
subject of all of Applicant's independent claims; and the fourth cited passage pertains 
to the behavior of macro viruses, not to Chen 's invention, and is therefore irrelevant. 

Similarly, with respect to claim 6, the Copy command recited in claim 6 is for the 
special case where the code is written in Visual Basic (page 13 lines 15-20), whereas 
the MacroCopy (not Copy) command that Chen discusses at column 14 lines 16-24 is 
for WordBasic, not Visual Basic. Column 13 line 64; column 5 lines 37-38. 

Further with respect to claim 6, the Examiner cited Chen column 8 lines 32-39 
and column 10 lines 52-56 for Applicant's recitation of "analyzing the code to determine 
whether said code contains instructions causing the flagged macro to be copied to a 
local document." The cited passages do not support this recitation. The passage at 
column 8 describes behavior of, not detection of, a macro virus and is therefore 
irrelevant. The cited passage at column 10 pertains to the correction of infected 



6 



macros, not to the detection of macro viruses to which all of Applicant's independent 
claims are exclusively directed. 

With respect to claim 7, the passage of Chen (column 16 lines 14-40) cited by 
the Examiner does not suggest the concatenation operator recited in claim 7. Said 
cited passage pertains to the treatment of infected macros, not to the detection of 
macro viruses, to which all of Applicant's independent claims are exclusively directed. 
Applicant's concatenation operator is described at page 18 lines 3-12 as a symbol, such 
as an ampersand, that concatenates two strings to assist detection module 17 in finding 
a location when the writer of malicious code has tried to obscure a location by breaking 
it into two pieces. The cited passage in Chen , on the other hand, pertains to macro 
treatment (cleansing). 

With respect to claim 8, the passage from Chen (column 14 lines 55-64) cited by 
the Examiner does not suggest Applicant's recitation in claim 8 that "each analyzing 
step makes substitutions for variable names when the code contains variable names 
that are proxied" (emphasis added). This recitation is discussed in Applicant's 
specification at page 18 line 13 through page 19 line 5. The cited passage from Chen 
suggests neither substitutions nor variable names. 

With respect to claim 9, the passages of Chen cited by the Examiner (column 5 
lines 49-52 and column 13 lines 41-49) do not suggest the recitation in Applicant's claim 
9 that "each analyzing step traces the values of parameter variables when the code 
contains instructions that are invoked by other code " (emphasis added). This recitation 
is discussed in Applicant's specification at page 19 lines 6 through 22. The cited 
passages from Chen suggest neither values of parameter variables nor instructions that 
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are invoked by other code. The second of the two cited passages pertains to behavior 
of macro viruses, not to the detection of macro viruses, and is therefore irrelevant. 

With respect to claim 10, the passages of Chen (column 5 lines 34-38, column 6 
lines 48-60, column 13 lines 64-67, and column 14 lines 38-64) cited by the Examiner 
do not suggest the recitation of claim 10 that "each analyzing step substitutes object 
names when the code is written in an object oriented programming language and when 
the code contains substituted object names " (emphasis added). This recitation is 
discussed in Applicant's specification at page 19 line 23 through page 20 line 13. The 
cited passages from Chen suggest neither object names, nor an object oriented 
programming language, nor substituted object names. By citing column 5 lines 34-38 
of Chen , the Examiner seems to be asserting that WordBasic is an object-oriented 
programming language. However, the Examiner has not provided any documentation 
establishing this point. 

With respect to claim 12, the Examiner stated that Chen discloses the detection 
of both publicly identified (known) and publicly identified (unknown) macro viruses. 
However, in Chen , known and unknown viruses are treated completely differently. See 
Figure 6 and accompanying description. In the present invention, on the other hand, as 
recited in claim 12, the exact same method steps (namely, the method steps recited in 
claim 1) are used for detecting both known and unknown viruses. This gives the 
present invention the significant advantage of being a much simpler solution than the 
Chen solution. 

The Examiner's arguments with respect to claims 13, 14, and 16 are virtually 
identical to the Examiner's arguments with respect to claim 1 . In rebuttal thereto, 
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Applicant hereby incorporates by reference the above discussion with respect to claim 
1, mutatis mutandis . 



For the above reasons, the Examiner is requested to withdraw her rejection of 
claims 1-16, and to allow these claims as amended. 

Applicant believes that this application is now in condition for allowance of all 
claims herein, claims 1-16 as amended, and therefore an early Notice of Allowance is 
respectfully requested. If the Examiner disagrees or believes that, for any other reason, 
direct contact with Applicant's attorney would help advance the prosecution of this case 
to finality, she is invited to telephone the undersigned at the number given below. 



Respectfully submitted 



Edward J. Radio 
Attorney of Record 
Reg. No. 26,793 




SONNENSCHEIN NATH & ROSENTHAL LLP 
P.O. Box 061080 

Wacker Drive Station, Sears Tower 
Chicago, I L 60606-1080 
Tel.: (41 5) 882-2402 



cc: 
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